npm RFC #868 will block this package's install script by default

Hi there,

I'm reaching out because vuepress is one of the most depended-on npm packages that runs an install script, and an accepted npm RFC is going to change how those scripts behave.

The RFC blocks dependency install scripts by default during npm install. That's the same thing pnpm, Yarn Berry, Bun, and Deno already do. Users opt back in per package through a new allowScripts field in package.json (or the npm approve-scripts command). The motivation is the run of supply-chain attacks over the last couple of years that used postinstall hooks to run code the moment a package landed in the tree.

For vuepress, the script that's affected is:

"postinstall": "opencollective-postinstall || exit 0"

That script is written to fail quietly and looks non-essential, so for most users blocking it changes nothing. No action is likely needed on your side. The one thing worth doing is a quick check that nothing important silently depends on it running, and if it does, documenting the allowScripts line in your README.

I wanted to flag this early so you've got time to plan rather than find out when the install warnings start showing up. The full RFC is here: https://github.com/npm/rfcs/pull/868. Happy to answer any questions.